Virus Bulletin, January 1993

January 1993 ISSN 0956-9979 THE AUTHORITATIVE INTERNATIONAL PUBLICATION ON COMPUTER VIRUS PREVENTION, RECOGNITION AND REMOVAL Editor: Richard Ford Technical Editor: Fridrik Skulason Consulting Editor: Edward Wilding Advisory Board: Jim Bates, Bates Associates, UK, Andrew Busey, Datawatch Corporation, USA, David M. Chess, IBM Research, Phil Crewe, Fingerprint, UK, David Ferbrache, Defence Research Agency, UK, Ray Glath, RG Software Inc., USA, Hans Gliss, Datenschutz Berater, West Germany, Ross M. Greenberg, Software Concepts Design, USA, Dr. Harold Joseph Highland, Compulit Microcomputer Security Evaluation Laboratory, USA, Dr. Jan Hruska, Sophos, UK, Dr. Keith Jackson, Walsham Contracts, UK, Owen Keane, Barrister, UK, John Laws, Defence Research Agency, UK, Tony Pitts, Digital Equipment Corporation, UK, Yisrael Radai, Hebrew University of Jerusalem, Israel, Martin Samociuk, Network Security Management, UK, John Sherwood, Sherwood Associates, UK, Prof. Eugene Spafford, Purdue University, USA, Dr. Peter Tippett, Certus Corporation, USA, Steve R. White, IBM Research, Dr. Ken Wong, PA Consulting Group, UK, Ken van Wyk, CERT, USA. CONTENTS SCANNER UPDATE 1993 Scanner Shoot-Out 8 EDITORIAL Imageline v. McAfee 2 VIRUS ANALYSES NEWS 1. The CMOS1 Virus 13 2. DOSHUNTER - Search S&S Caught Out 3 And Destroy 15 Chinese Whispers 3 3. Penza - Variations on a Familiar Theme 16 A Rose By Any Other Name 3 PRODUCT REVIEWS IBM PC VIRUSES (UPDATE) 4 1. IBM AntiVirus 18 INSIGHT 2. PC Tools 8 21 Scotland Yard’s Virus Hunters 6 END NOTES & NEWS 24 VIRUS BULLETIN ©1993 Virus Bulletin Ltd, 21 The Quadrant, Abingdon Science Park, Oxon, OX14 3YS, England. Tel (+44) 235 555139. /90/$0.00+2.50 This bulletin is available only to qualified subscribers. No part of this publication may be reproduced, stored in a retrieval system, or transmitted by any form or by any means, electronic, magnetic, optical or photocopying, without the prior written permission of the publishers. Page 2 VIRUS BULLETIN January 1993 and damage to Imageline’s business reputation as a result of EDITORIAL the false indications that Imageline’s products are infected with viruses.’ Imageline v. McAfee Bill McKiernan, President of McAfee Associates, refused to comment on the case and simply stated that the suit is The detection of a virus in an uninfected file is an all-too ‘totally without merit’ and that McAfee Associates ‘will frequent occurrence with virus scanners. This is not always vigorously defend itself.’ the manufacturer’s fault, but the knotty problem of whether the anti-virus software vendor is in any way liable for any The implications of this case are far-reaching. Arguably, subsequent inconvenience has, until now, to be explored. false positives are becoming the overriding concern for both This important question is about to be addressed in the the anti-virus industry and the users. It is commercially United States, as McAfee Associates is being sued for damaging for a virus scanner to produce false positives - $750,000 as a result of a false positive dispute. even more so than its missing a handful of viruses. The central issue in the case is not directly about a scanner It is equally damaging to software which is erroneously detecting a false positive, but addresses the issue of what identified as infected, as this can result in loss of confidence action the manufacturer is required to take when such a in the package. The question of how to act when such a situation occurs. situation occurs now needs to be addressed. The problem arose at the start of last year, when McAfee Every virus scanner is prone to false positives - it is Associates Pro-Scan version 2.33 detected the 7808 virus in something which occurs to all scanner manufacturers from an executable sent out with some clip-art. Imageline, the time to time. Clearly a situation in which litigation can producers of the clip-art, contacted McAfee, which updated result from any false positive identification is ridiculous. In its software, thus removing the false positive problem. At these circumstances, scanner manufacturers would have no this point the dispute should have ended. choice but to shut up shop and return home. However, Imageline continued to receive complaints about If this case shows that a vendor has no responsibility for its software being infected with a virus, although McAfee false positives produced by its product, a worrying prec- Associates assured Imageline that ‘As far as McAfee can edent is set: if a company is sufficiently small, and its determine, it has distributed fewer than forty copies of Pro- software is of limited circulation, an anti-virus vendor could Scan version 2.33.’ By this time, Imageline’s product had simply ignore its plea for help. Put bluntly, if the problem is acquired a somewhat tarnished image, and so they implored small enough, there is no financial incentive for the anti- McAfee Associates to inform all customers of the problem. virus manufacturer to set the record straight. Imageline finally sought a court injunction which required The results of this action may well affect those distributing McAfee Associates to stop distribution of that version of shareware anti-virus software more than other vendors. It is Pro-Scan and any third party products which used that far easier to inform users of a potential problem if they have version under licence. The injunction also ordered McAfee purchased software directly than to trace users of an to inform all buyers of the product about the problem. electronically distributed product, which could have been downloaded from one of any number of bulletin boards. According to documents obtained by Virus Bulletin, Imageline is now suing for ‘compensatory damages in the If it is shown that the onus is on the scanner manufacturer to amount of $250,000 and punitive damages in the amount of deal with false positives, the problem of deliberately $500,000’. In the complaint, brought in Civil Action including scan strings within code raises its ugly head. It Number 3:92CV710, Imageline claims that ‘The mere would then be possible to target a scanner, and force its accusation that computer software contains a virus threatens vendors to alter search patterns. The even more complicated immediate destruction of the software’s viability in the issue of scanners detecting virus patterns in other scanners market. In the case of a start up company such as could become a legal minefield. In such a world, only the Imageline, such accusations create a substantial risk that the brave or the foolish would produce a scanner. company could be forced out of business.’ Whichever way the case is decided there are stormy seas Furthermore, the action alleges that ‘As a direct, proximate ahead for both the software industry and, more specifically, and foreseeable result of the foregoing misrepresentation by the anti-virus industry. McAfee Associates is certainly not McAfee, Imageline has been damaged. Such damages the only scanner manufacturer who will be waiting for the include, but are not limited to, the loss of sales opportunities results of the trial with bated breath. VIRUS BULLETIN ©1993 Virus Bulletin Ltd, 21 The Quadrant, Abingdon Science Park, Oxon, OX14 3YS, England. Tel (+44) 235 555139. /90/$0.00+2.50 This bulletin is available only to qualified subscribers. No part of this publication may be reproduced, stored in a retrieval system, or transmitted by any form or by any means, electronic, magnetic, optical or photocopying, without the prior written permission of the publishers. January 1993 VIRUS BULLETIN Page 3 The story originated at a press conference held by Titia NEWS Electroniks. This company acts as an agent for Computer Security Engineers Ltd, developer of the PCVP anti-virus S&S Caught Out package. De Telegraaf sent a financial editor, Klaus Steenhuis to the meeting. It was during this press conference that Steenhuis and assembled journalists were told, as Dr Solomon’s Anti-Virus Toolkit has failed to detect a virus an aside, how the Nines Complement virus had been found on some five hundred evaluation copies of a printer driver in a single pharmacy. From this small beginning grew De from Limerick-based software manufacturer DCA. The Telegraaf’s front page news story. infected disks were sent to journalists throughout Western Europe and the Middle East. The first report received by Virus Bulletin spoke of ‘NineComp virus being endemic in pharmacies in the A copy of the virus was subsequently sent to S&S Interna- Hague, with hundreds of machines affected.’ The number of tional which identified it as a NoInt variant. Ironically, this machines that were actually infected in the original incident new variant was detected by many other virus scanners on was, in fact, just two. the market. It appears that the search string used by the Toolkit had been targeted and altered in the variant. It is worthwhile looking to see who are the winners and losers in this story. The obvious loser is the Dutch public, This incident again illustrates the danger of relying on one which has lost still more faith in the computer and has had single package for virus detection - two or more unrelated its technophobia reinforced. The winner was De Telegraaf, scanners should always be used for critical machines. It also which gained a suitably lurid headline. emphasises the shortcomings of using virus-specific detection. A sound anti-virus strategy should therefore But what about the anti-virus industry? On the one hand, always encompass integrity checking. the report raised the public perception of the danger of computer viruses. On the other, such recurring sensational- Placing a sticker on a disk which reads ‘certified virus-free ism has further tarnished the industry’s already less than by Acme Software’ is no guarantee of that disk’s integrity.

Load more